CtrlK
BlogDocsLog inGet started
Tessl Logo

functions-falcon-api

Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function handlers. TRIGGER when user asks to "call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function", or needs to integrate Falcon platform APIs within serverless function code. DO NOT TRIGGER when user wants to expose external third-party APIs to Foundry — use api-integrations instead.

86

1.13x
Quality

81%

Does it follow best practices?

Impact

99%

1.13x

Average score across 3 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable skill body with executable Python/Go examples, explicit gotchas, and well-signaled one-level-deep references. Its main weakness is conciseness: the deprecated-Detects warning and some auth guidance are restated multiple times, inflating the token budget without adding new information.

Suggestions

Consolidate the Detects/Detects-API deprecation warning into a single clearly marked DEPRECATED section; the current three repetitions (system-injection block, dedicated callout, and Detection Queries subsection) inflate tokens without adding information.

Move the large verified-scope reference table (9 rows) and the full LogScale query helper into references/advanced-patterns.md, leaving a concise inline summary plus a pointer, to tighten the overview and strengthen progressive disclosure.

Trim restated auth guidance (e.g., the zero-arg constructor point appears in the intro, the Python section, and Common Pitfalls) to a single canonical explanation with brief cross-references.

DimensionReasoningScore

Conciseness

Mostly efficient with heavy use of executable code, but the Detects/Detects-API deprecation warning is repeated three times (system-injection block, dedicated DEPRECATED block, and the Detection Queries subsection) and several gotcha blocks restate auth guidance, adding padding that could be consolidated.

3 / 5

Actionability

Provides copy-paste-ready, complete executable code for Python and Go handlers, concrete FQL filter examples, manifest.yml scope snippets, a 207 handling recipe, and a runnable test with mocks, fully covering the common cases.

5 / 5

Workflow Clarity

The query-then-get-details shape is clearly sequenced with explicit status_code validation checkpoints and error-branch returns throughout, plus a 207 multi-status feedback loop; it falls short of 5 only because the document is organized as parallel reference patterns rather than a single end-to-end workflow with a complete validate-fix-retry checklist.

4 / 5

Progressive Disclosure

Well-sectioned body with a clear Reference Files table and inline pointers to the real one-level-deep references/advanced-patterns.md; no nested references. It is not a 5 because the large inlined scope table and several full-code examples could arguably live in the reference file to keep the overview leaner.

4 / 5

Total

16

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states the capability, gives concrete natural-language triggers covering both SDKs, and explicitly disambiguates from the related api-integrations skill via a DO NOT TRIGGER clause. Slightly below perfect on specificity and trigger coverage due to minor missing synonyms rather than any structural weakness.

DimensionReasoningScore

Specificity

Names the domain (CrowdStrike Falcon APIs) and several concrete capability areas (detections, alerts, hosts, RTR) and the execution context (Foundry function handlers), with only minor gaps in coverage versus the comprehensive 5-anchor.

4 / 5

Completeness

Explicitly answers both what ("Call CrowdStrike Falcon platform APIs ... from within Foundry function handlers") and when with concrete TRIGGER and DO NOT TRIGGER clauses, matching the 5-anchor.

5 / 5

Trigger Term Quality

Includes natural trigger phrases users would say ("call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function") covering both SDK synonyms, though a few common variations are absent.

4 / 5

Distinctiveness Conflict Risk

Clear niche with explicit disambiguation directing external-third-party-API exposure to api-integrations, minimizing conflict risk with sibling skills.

5 / 5

Total

18

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 2 suspicious

Warning

Total

13

/

16

Passed

Repository
CrowdStrike/foundry-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.